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ABSTRACT 

The  Space-Based  Infrared  Systems  (SBIRS)  program  represents  a  “system  of  systems,”  that  is  a 
critical  part  in  the  United  States  Intelligence,  Surveillance,  and  Reconnaissance  (ISR)  capability. 
SBIRS  is  managed  by  a  large  multi-dimensional  team.  In  addition  to  their  other  duties,  the  team  is 
faced  with  a  daunting  logging  challenge.  The  extensive  required  logging  places  significant  demands 
on  the  SBIRS  team  and  can  at  times  siphon  resources  from  the  task  at  hand.  Moreover,  once  logged, 
events  are  essentially  “locked”  into  the  logbooks.  Extracting  data  from  the  books  is  an  arduous  and 
seldom  performed  process.  The  result  is  that  valuable  knowledge  remains  inert.  Here,  we  describe 
the  Event  Logging,  Analysis,  and  Reporting  System  (ELARS)  as  an  enabling  technology  for 
knowledge  management.  ELARS  simplifies  the  process  of  entering  log  data  and  producing  a  range  of 
associated  knowledge  products  that  support  state  and  trend  analysis  across  varied  timescales  to 
improve  operational  efficiency.  In  doing  so,  it  activates  the  previously  inert  knowledge. 


Public  reporting  burden  for  the  collection  of  information  is  estimated  to  average  1  hour  per  response,  including  the  time  for  reviewing  instructions,  searching  existing  data  sources,  gathering  and 
maintaining  the  data  needed,  and  completing  and  reviewing  the  collection  of  information.  Send  comments  regarding  this  burden  estimate  or  any  other  aspect  of  this  collection  of  information, 
including  suggestions  for  reducing  this  burden,  to  Washington  Headquarters  Services,  Directorate  for  Information  Operations  and  Reports,  1215  Jefferson  Davis  Highway,  Suite  1204,  Arlington 
VA  22202-4302.  Respondents  should  be  aware  that  notwithstanding  any  other  provision  of  law,  no  person  shall  be  subject  to  a  penalty  for  failing  to  comply  with  a  collection  of  information  if  it 
does  not  display  a  currently  valid  OMB  control  number. 
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Introduction 


The  Space-Based  Infrared  Systems  (SBIRS) 
program  represents  a  “system  of  systems,” 
combining  the  power  of  geosynchronous  orbit 
(GEO),  highly  elliptical  orbit  (HEO),  and  low 
earth  orbit  (LEO)  satellites  with  a  state-of-the- 
art  ground  station  to  provide  near  real-time 
strategic  and  tactical  data  to  national  and 
regional  command  authorities. 

SBIRS  is  planned  for  incremental 
development.  During  the  first  increment,  the 
SBIRS  ground  station  functionality  was  stood 
up  and  is  replacing  the  ground  station  portions 
of  the  Defense  Support  Program  (DSP)  and 


Sonalysts,  Inc.  and  the  United  States  Air  Force 
Research  Laboratory  have  partnered  to 
conduct  research  to  determine  how  the 
efficiency  of  the  SOC  could  be  improved. 
These  discussions  quickly  lead  us  to  realize 
that  an  automated  logging  backbone  could  be 
leveraged  to  support  many  of  the  other  need 
areas  (see  Figure  1). 

Logging  provides  a  rich  data  set  on  which  to 
build  an  array  of  performance  support 
processes.  For  example,  certain  events,  when 
logged,  might  signal  increased  or  decreased 
system  capability.  An  appropriately  structured 
logging  system  could  recognize  this  change 
and  alert  mission  operators  within  the  SOC, 
improving  crew  coordination.  Similarly, 


Figure  1.  Logging  as  an  Enabling  Technology 


Attack  Launch  and  Early  Reporting  to  Theater 
(ALERT)  early  warning  systems.  During  the 
second  increment,  HEO  and  GEO  satellites 
will  join  the  constellation  (in  2002  and  2004, 
respectively).  The  sensor  package  aboard 
these  satellites  will  have  both  better  sensitivity 
and  flexibility.  During  the  third  increment,  still 
in  competitive  procurement,  LEO  satellites  will 
be  added  to  the  mix.  These  satellites  will  track 
long-range  tactical  and  strategic  missiles  and 
represent  a  cornerstone  technology  for  the 
National  Missile  Defense  Program.  The  LEO 
satellites  have  the  potential  to  provide  a  wealth 
of  tactical  data,  culminating  in  advanced 
battlespace  characterization  (BSC)  and  the 
“sensor-to-shooter”  concept. 

All  of  these  diverse  vehicles  and  payloads  will 
be  managed  at  the  SBIRS  Mission  Control 
Station  (MCS)  at  Buckley  AFB,  Colorado. 
SBIRS  operations  will  be  guided  in  the  Space 
Operations  Center  (SOC)  within  the  MCS. 


cues/alerts  generated  by  the  logging  system 
could  represent  a  significant  performance¬ 
monitoring  tool.  Clearly,  collecting  log  data  in 
an  organized  and  searchable  manner  makes  it 
possible  to  generate  a  range  of  periodic  and 
episodic  reports.  Closely  related  to  this  is  the 
ability  to  look  for,  spot,  and  report  trends  that 
appear  across  log  entries.  Although  not 
immediately  obvious,  a  centralized  logging 
system  could  be  leveraged  to  provide 
important  training  data.  For  example,  if  an 
operator  has  not  experienced  a  certain  type  of 
event  for  a  long  period  of  time  (as  indicated  by 
a  lack  of  log  entries  for  that  event  type),  it 
might  be  useful  to  arrange  refresher  training 
on  that  event.  Similarly,  if  the  logs  indicate 
that  the  mean  time  to  respond  to  a  given  event 
is  X,  and  we  note  that  a  given  operator 
consistently  takes  2X  to  respond  to  that  type  of 
event,  we  can  assume  that  training  on  that 
class  of  event  may  be  beneficial. 


An  Event  Logging  System 

Today,  all  S6IRS  activities  are  manually 
logged  in  green  logbooks  maintained  by  the 
SBIRS  staff.  The  logbooks  include 
documentation  for  all  aspects  of  the  SBIRS 
mission.  The  crew  commander  must  log  all 
mission  events,  tasking  requirements,  crew 
changeovers,  operational  capabilities 
(OPSCAP)  changes,  and  the  activation  of 
emergency  procedures/checklists. 

Satellite  and  ground  station  personnel  must 
log  information  about  satellite 
communications,  commands  sent  to  the 
satellite,  the  outcome  of  the  commands, 
satellite  or  ground  station  anomalies  and  their 
resolution. 

The  intelligence  team  maintains  a  log  that 
provides  the  intelligence  overview.  They  will 
log  events  such  as  changes  to  the  posted 
pending  launch  list,  tip-off  information,  period 
of  interest  start  and  stop  times  as  well  as 
location  and  current  intelligence  indicators, 
tactical  flight  operations  start  and  stop  times 
and  any  significant  intelligence  activity 
occurring  in  that  period,  requests  for 
information  either  initiated  or  resolved,  any 
other  intelligence  data  that  complements  the 


into  the  logbooks.  Extracting  data  from  the 
books  is  an  arduous  and  seldom  performed 
process.  Instead  of  using  the  data  to  improve 
operations,  it  is  logged  and  forgotten. 

The  focus  of  Sonalysts,  Inc.  and  the  Air  Force 
Research  Laboratory  has  been  to  make  the 
knowledge  contained  in  logs  available  for 
more  widespread  use.  Many  of  the  enabling 
capabilities  can  be  encompassed  within  a 
robust  Event  Logging,  Analysis,  and  Reporting 
System  (ELARS).  ELARS  will  support  the 
SOC  staff  by  aiding  the  completion  and 
processing  of  automatically  generated  event 
entries;  the  creation  and  processing  of  manual 
event  entries;  the  generation  of  ad-hoc  and 
standard  reports;  and  through  intra-SOC 
notification  of  significant  events.  ELARS  will 
also  provide  support  to  groups  external  to  the 
SOC.  Reports  and  status  information  based 
on  events  can  be  produced  on  a  periodic  and 
episodic  basis. 

A  gross  system  schematic  is  shown  in  Figure 
2.  Here  we  posit  that  each  station  in  the  SOC 
is  equipped  with  the  ability  to  log  events.  The 
log  entry,  properly  tagged,  is  transferred  to 
some  storage  area  for  archiving.  Various 
processes  or  "business  rules”  operate  on  this 
master  log  to  provide  different  products  to 


Figure  2.  ELARS  System  Overview 


team’s  situation  awareness. 

This  logging  places  significant  demands  on  the 
SBIRS  team  and  can  at  times  siphon 
resources  from  the  task  at  hand.  Moreover, 
once  logged,  events  are  essentially  “locked" 


different  users  in  different  time  frames. 

Within  this  scheme,  it  is  important  to  account 
for: 

•  Data  Collection, 


•  Data  Storage, 

•  Processing,  and 

•  Products. 

Supporting  data  collection  over  the  wide  range 
of  required  log  entries  is  obviously  central  to 
the  logging  process  and  represents  the  most 
significant  technical  challenge.  A  temptation 
might  be  to  simply  re-host  the  current  logging 
strategy  in  an  electronic  format.  However, 
there  is  ample  evidence  that  simply  re-hosting 
a  pencil-and-paper  process  often  reduces 
efficiency  (see,  for  example,  Landauer,  1997). 
Instead,  to  gain  efficiencies,  the  task  itself 
must  be  fundamentally  changed  to  leverage 
the  capabilities  inherent  in  the  electronic 
medium. 

Just  as  the  system  can  automatically  detect 
some  events  (launches,  system  anomalies, 
etc.),  it  should  be  able  to  initiate  logging 
activities.  This  would  represent  a  significant 
workload  reduction  by  automatically  collecting 
the  subset  of  the  required  information 
derivable  from  the  system  itself.  Similarly,  just 


Log  Entry  Notification  Sub-system  (LENS). 
The  LENS  would  be  responsible  for  identifying 
the  outstanding  “loggable”  events/activities  for 
each  station,  allowing  station  operators  to 
initiate  independent  log  entries,  and  providing 
an  interface  for  completing  and  managing  log 
entries  initiated  by  the  system  or  the  operator. 

A  notional  user  interface  for  the  logging  portion 
of  LENS  is  shown  in  Figure  3.  The  interface 
comprises  four  functional  areas.  In  the  upper- 
lefthand  corner  of  the  display  is  a  list  of 
events/activities  that  the  monitoring  portion  of 
the  LENS  has  detected  for  this  station  and  that 
await  operator  logging,  in  the  lower-lefthand 
corner,  the  list  of  log  entries  that  can  be 
manually  initiated  at  this  station  are  presented. 
Clicking  on  an  item  contained  in  either  list 
would  launch  a  form  tailored  to  that  type  of 
entry.  On  the  righthand  side  of  the  screen, 
identifying  information  for  the  operator  at  this 
station  and  at  other  positions  in  the  SOC  is 
presented. 

Much  of  the  data  required  by  the  logs  is  known 


Figure  3.  Notional  User  Interface 


as  the  operator  may  detect  events  missed  by 
the  automation,  he/she  should  be  able  to 
initiate  logging  independently.  Even  manually 
initiated  log  entries  will  benefit  from  the 
automatic  inclusion  of  identification  and  time- 
stamp  information. 

The  monitoring  and  logging  ELARS 
components  can  be  combined  into  a  powerful 


to  the  system;  therefore,  it  should  be  possible 
to  use  this  system  knowledge  to  partially 
complete  the  log  entry  form  presented  by  the 
LENS.  Where  data  is  unknown  to  the  system 
or  otherwise  unavailable,  the  LENS  will 
provide  the  operator  with  a  structured  process 
for  providing  it.  In  addition,  ELARS  will  include 
entirely  novel  sources  of  data.  For  example, 
summarized  log  entries  from  subordinates 


might  be  included  in  a  supervisor's  log  entry. 
At  the  same  time,  the  supervisor  might  simply 
augment  or  annotate  an  existing  log  entry, 
including  its  contents  by  reference,  not  by 
repetition. 

The  logging  component  of  the  LENS  also 
supports  event  routing  and  event  modification. 
Routing  paths  can  be  specified  by  event  type. 
When  an  individual  completes  an  event  log 
entry  that  is  to  be  routed,  the  completed  event 
is  recorded  and  routed  as  necessary  for 
review  or  augmentation.  The  stations  to  which 
they  are  routed  must,  at  a  minimum, 
acknowledge  all  routed  log  entries. 

Although  not  necessarily  a  technical 
challenge,  it  is  important  for  ELARS  to  have  a 
solid  repository  for  the  storage  of  log  data. 
Without  a  solid  repository  for  the  central  log, 
the  processes  will  not  able  to  produce  the 
needed  products.  The  architecture  of  the 
central  log  must  be  support  large-scale,  highly 
reliable  storage.  At  the  same  time,  it  must 
support  both  real-time  access  to  some  data 
(for  cueing/alerting,  etc.)  and  data 
warehousing  (for  longer  term 
processes/reports) . 

Log  storage  and  management  is  the  function 
of  the  Automatic  Repository  Management 
System  (ARMS).  The  ARMS  includes  both  the 
repository  itself  as  well  as  the  associated 
management  functions. 

The  repository  portion  of  ARMS  represents  the 
actual  storage  mechanism  for  the  output  of  the 
LENS.  The  management  portion  of  ARMS  is 
responsible  for  maintaining  the  integrity  of  the 
repository.  All  event-related  storage  and 
retrieval  operations  are  performed  through  this 
component,  which  represents  a  central  point  of 
access  control  and  an  independent  transaction 
logging  capability  for  events. 

Various  tailored  businesses  processes  work 
on  the  stored  data  to  produce  the  required 
products.  Some  of  these  processes,  like  those 
to  support  cueing  and  alerting  must  function  in 
real  time.  Others,  for  example  those  that 
generate  internal  and  external  reports,  can 
function  at  other  than  real  time.  Similarly,  the 
analyses  can  capture  the  state  of  operations, 
personnel,  or  the  system  or  trends  within  these 
functional  areas. 


Within  ELARS,  data  processing  will  become  a 
largely  automated  function.  In  general, 
ELARS  will  produce  draft  reports  that  can  be 
reviewed  and  modified  as  required  by  SOC 
personnel. 

The  most  compelling  feature  of  the  centralized 
log  is  the  vast  array  of  data  products  that  can 
be  generated  from  it.  Sonalysts  envisions  a 
system  that  is  capable  of  producing  data 
products  periodically  or  on  an  episodic  basis. 
These  products  can  be  made  available  to 
other  members  of  the  SOC,  as  well  as  outside 
agencies. 

By  considering  these  temporal  and  population 
dimensions,  one  can  quickly  begin  to  generate 
a  series  of  useful  products.  For  example, 
consider  the  list  offered  in  Table  1.  Sample 
data  products  that  would  be  used  within  the 
SOC  and  would  be  classified  as  “quick 
reaction"  include  alerting/cueing  notices  that 
would  relay  news  of  an  event  to 
interested/impacted  parties.  The  central  log 
would  also  allow  drill-down  reviewing  of  logs. 
As  higher  authorities  review  events,  they  often 
are  required  to  annotate  earlier  logs  of  the 
event  (e.g.,  validate  that  the  proper 
procedures  were  applied  or  that  a  piece  of 
faulted  equipment  is  now  functioning).  With 
the  central  log,  this  can  be  accomplished  by 
annotating  the  log  entry  directly,  providing 
those  higher  in  the  chain  of  command  with  the 
ability  to  review  the  summarized  annotation 
and,  optionally,  drill  down  to  the  source  log 
entry  details. 

Remaining  within  the  SOC,  but  stretching  the 
timescale  slightly,  allows  us  to  consider 
periodic  reports  like  changeover  briefs  and 
morning  standup  reports.  In  addition,  we  can 
consider  novel  reports  such  as  a  training 
analysis  or  proficiency  report.  The  training 
analysis  would  identify  events  that  are  missing 
from  or  infrequently  recorded  in  the  log  and 
suggest  the  need  for  refresher  training  on 
these  events.  The  proficiency  report  would 
note  the  observed  performance  for  each 
operator  on  a  series  of  critical  events  and 
compare  the  observed  performance  with 
cross-operator  averages. 

These  same  reports  might  be  of  interest  to 
those  outside  the  SOC.  In  addition,  the  Site 
Report  is  a  common  report  that  would  be 
greatly  facilitated  by  a  central  log. 


Table  1.  Sample  Knowledge  Products 


Population 

■ 

Inside  SOC 

Outside  SOC 

Quick  Reaction 

Alerting/Cueing 

Notices 

Drill-down  Reports 

Short  Term 

Changeover  Brief 

Morning  Standup 

Site  Report 

Training  Analysis 

H 

« 

ki 

fa 

Training  Analysis 

Proficiency  Report 

Proficiency  Report 

S 

H 

Long  Term 

MTBF  Report 

MTTR  Report 

Checklist  Tailoring 

Event  Reconstruction 

Statistical  Mining 

Custom  Reports 

We  can  also  consider  longer-term  reports  that 
might  be  of  particular  interest  outside  the 
SOC.  Obvious  examples  from  systems  logs 
include  items  such  as  mean  time  between 
failure  (MTBF)  and  mean  time  to  repair 
(MTTR).  Less  obvious  might  be  opportunities 
to  tailor  checklists  as  a  result  of  log  analysis. 
Consider  troubleshooting  checklists. 
Normally,  these  checklists  manifest  some  form 
of  a  split-half  analysis  methodology.  However, 
the  data  within  the  logs  may  point  to  more 
common  causes  of  failure.  Knowledge  of 
these  common  causes  can  be  used  to  modify 
the  checklist  to  direct  attention  to  the  most 
likely  failure  sources,  thereby  reducing  MTTR 
and  increasing  system  availability.  From  time 
to  time,  it  may  be  necessary  to  reconstruct  an 
anomalous  event  (e.g.,  the  loss  of  a  satellite). 
The  centralized  log  would  greatly  facilitate  this 
process.  It  would  also  make  it  easier  to  mine 
the  data  contained  in  logs  to  spot  statistical 
trends  or  to  generate  custom  reports. 

As  these  sample  products  indicate,  a 
centralized  repository  will  increase  operational 
efficiency  by  streamlining  the  production  of 
currently  required  reports  while  making  it 


possible  to  generate  a  wide  range  of  “value- 
added”  reports. 


The  ability  to  produce  data  products  rests  on 
the  Query  and  Report  Functions.  The  Query 
Component  provides  the  capability  to  perform 
interactive  queries  of  the  event  repository. 
The  information  is  formatted  as  appropriate  for 
the  query  and  is  displayed  or  printed  as 
desired  by  the  user. 

The  Report  Component  provides  the  capability 
to  define  and  produce  formatted  reports. 
These  reports  can  be  scheduled  for  automatic 
generation  and  distribution  or  used  on  an  as- 
needed  basis.  These  are  web-based 
interfaces  to  permit  intranet  access,  as 
desired.  This  also  minimizes  impact  on  SOC 
computing  resources  by  restricting  significant 
database  related  processing  to  non-SOC 
station  resources. 

Summary 

The  ELARS  represents  a  knowledge 
management  enabling  technology.  By 
increasing  the  ease  with  which  operators  can 


record  and  subsequently  access  knowledge 
contained  within  logs,  the  ELARS  takes  the 
inert  knowledge  and  makes  it  active.  The 
active  knowledge  can  improve  the  efficiency  of 
SOC  coordination,  report  generation,  training, 
and  maintenance. 
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